Skip to content
S
StayEvident
ISO/IEC 42001:2023 · AI management

Your ISO/IEC 42001 AI management system, from inventory to SoA.

StayEvident assesses your AIMS documentation against clauses 4–10 and the 38 Annex A controls, keeps an inventory of your AI systems with their impact assessments and data resources, and generates your Statement of Applicability.

Get startedSee how it works

An inventory of your AI systems

Record each AI system with your role — developer, provider or user — its intended use, model source and supplier, data sources, human oversight, life-cycle stage and risk level. The risk level sets how often its impact is reassessed.

Impact assessments with a history

Assess who each system affects, how, and what mitigates it, with an outcome of acceptable, acceptable with conditions or unacceptable. The system's impact status always follows its latest assessment.

Built to sit beside your ISMS

Most ISO/IEC 42001 organisations already run ISO/IEC 27001. Clauses 4–10 share evidence with your other standards, and 42001's Annex A is cross-referenced to the related ISO/IEC 27001 controls.

Coverage

Clauses 4–10 and every Annex A control.

Every requirement is assessed against your documents. The registers ISO/IEC 42001 is organised around — AI systems, impact assessments and data resources — sit alongside your risks, audits and suppliers.

ClauseRequirement
4–10AIMS clausesAssessed clause by clause by AI against your documents, with quoted evidence; you confirm or override each verdict
6.1.2–6.1.3AI risk assessment and treatmentRisk register on your configurable matrix, with risks linked to the Annex A controls that treat them
6.1.4AI system impact assessmentAI system inventory with dated impact assessments: who is affected, impacts, mitigations and an outcome
6.2AI objectivesObjectives & KPIs with targets and periodic measurements
7.5Documented informationDocument control plus a checklist of the documented information 42001 requires
8.4AI system impact assessment (operation)Reassessment cadence set by each system's risk level, with overdue assessments shown as drift
9.2–9.3Internal audit and management reviewIntegrated audits across standards; reviews with register inputs, exported as a PDF pack
A.2–A.10Annex A controls (38)Each control assessed; excludable individually or by objective, with the justification on your Statement of Applicability
A.7Data for AI systemsAI data resources register: provenance, acquisition, quality requirements and checks, preparation and retention
A.10.3SuppliersSupplier register for providers of AI services, products, models and data

Common questions

Does it include a Statement of Applicability for 42001?+

Yes. Exclude an Annex A objective or control with a justification, record why included controls apply and which risks they treat, and download the Statement of Applicability as a PDF — the same way as for ISO/IEC 27001. See Statement of Applicability.

Does it help with the EU AI Act?+

StayEvident is an ISO/IEC 42001 tool, not an AI Act compliance product. If you tell us you operate in the EU, the assessor draws on EU-specific notes for relevant controls, and you can record the Act as an obligation in the compliance obligations register.

StayEvident uses AI itself. How does that work?+

Assessments run on Anthropic's Claude models. The AI must quote your own documents to support a verdict, every quote is checked before a finding is saved, and a person confirms or overrides every finding. Your content is never used to train models. See Security.

Does StayEvident replace our copy of ISO/IEC 42001?+

No. Clause and control guidance in StayEvident is written in our own plain English. You still need your own licensed copy of the standard.

Stop dreading audit season.

Upload your documents, adopt a standard, and see clause-by-clause coverage — including the gaps you didn't know about.

Get startedTalk to us